18 ms·

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev be

• stephenr 11y ago
  They downloaded Xcode from somewhere besides Apple. How much more clue do you need about their stupidity.
  • cjensen 11y ago
    Gatekeeper makes that a lot safer than you might think. The only downside is that it's not obvious how to check who signed it. If you could easily verify it's signed by Apple, that would be 100% safe.
    • perrycynic 11y ago
      $ spctl --assess --verbose /path/to/.app
• jlarocco 11y ago
  I don't think having Gatekeeper disabled is a very big deal. It's one of the first things I disable on a new Mac. I've never had it stop an actual piece of malware, and it triggers false positives on practically everything. That said, I have no idea why anybody would download XCode from a third party...
  • nadams 11y ago
    > That said, I have no idea why anybody would download XCode from a third party... Easily explainable really. Went to [their favorite search engine], searched for "Xcode download" and clicked the first result which may not be from Apple (or an advertising).
    • gpvos 11y ago
      If you do that, you're too stupid to be a developer, really.
      • jahewson 11y ago
        Apparently not.
      • dang 11y ago
        Personal attacks are not allowed on Hacker News.
  • e28eta 11y ago
    Apparently downloads from Apple in China are very slow. So it's common practice to get it from a p2p network instead. I can totally understand it, but wouldn't do it myself (I think)
  • epmatsw 11y ago
    If you've had it disabled for a while, you should give it another go. Just about every app is signed now. I think the only one on my machine that isn't at this point is PopcornTime (for obvious reasons).
    • jlarocco 11y ago
      Actually, many Apple upgrades have a side effect of turning it back on, so I end up giving it another shot whether I want to or not every few months. Both my MBP and iMac had it turned on after the last Apple updates a few days ago, and I found out when I wasn't allowed to run something. If it were just unsigned apps I wouldn't mind so much, but it's the stupid, "This application came from the internet..." dialog box that drives me nuts most of the time.
  • jonknee 11y ago
    > I've never had it stop an actual piece of malware, and it triggers false positives on practically everything. Well it would have stopped this actual piece of malware! How often are you installing unsigned applications that a single right click to add to a whitelist is too much effort?
    • jlarocco 11y ago
      > Well it would have stopped this actual piece of malware! And I'm not infected by this piece of malware, so I still trust myself over Gatekeeper. > How often are you installing unsigned applications that a single right click to add to a whitelist is too much effort? Far more often than I install things from the app store. I don't find it to be a useful feature, so I disable it.
      • jonknee 11y ago
        > And I'm not infected by this piece of malware, so I still trust myself over Gatekeeper. That's idiotic.
• masklinn 11y ago
  Disabling gatekeeper is not uncommon, and was really common early on as many applications were not signed yet. Downloading Xcode from a third party, now that's stupid.
  • kitsunesoba 11y ago
    I personally leave gatekeeper enabled. If I really need to run unsigned binaries I can just right-click -> open in the Finder. This way, any runs of unsigned code is only allowed because of an explicit per-instance decision on my part. It may be overkill, but I think the extra safety gained is worth it. EDIT: I should mention that I work as an iOS engineer. Gatekeeper has not once impeded my work.
  • Klathmon 11y ago
    It's getting downloaded from a 3rd party because those 3rd parties are behind the Great Firewall in china. Without those local caches the xcode download can sometimes take days or never finish at all. Downloading from a 3rd party is fine IMO (after all the internet is just a big game of whisper-down-the-lane), but verifying checksums and signatures is incredibly important.
• CitizenKane 11y ago
  This was done in China and happened with the Chinese version of the App Store. In all honesty, like many things on the Chinese web it's likely difficult to find these resources. Baidu isn't a very effective search engine and there are tons of people trying to get their mitts on user data including the government themselves.
• toufka 11y ago
  If you're living in the land of gray-market computers/software, you'll never have gatekeeper installed to begin with. It's likely that the devs had disabled gatekeeper for other reasons - to run versions of local software also unsigned by Apple for lack of a (paid) Official Apple Developer Account.
  • jahewson 11y ago
    No need to disable gatekeeper for that. Unsigned software can be run by launching via the right-click menu, which adds an "Open" button to the gatekeeper dialog box, allowing gatekeeper to be bypassed for hat one specific app. OS X will then remember that choice.
• klausa 11y ago
  I see a lot of people saying they disable Gatekeeper on purpose. Is the "right-click and open" trick that disables Gatekeeper for that app generally unknown? Or do people value not being assed to do it more than (potential) security upsides?
  • soccerdave 11y ago
    I wasn't aware of this shortcut until now. I've been going the long route through Settings. Thanks for the tip!
    • Eric_WVGG 11y ago
      same. Awesome, but unlikely to be common knowledge IMO.
  • galad87 11y ago
    The right click trick works only if the app is not signed. If the app signature is invalid it won't work. You have to disable gatekeeper completely to open the invalid Xcode version.
    • deleted 11y ago
      [deleted]
    • gress 11y ago
      Why would you do that?
    • jonknee 11y ago
      > The right click trick works only if the app is not signed. If the app signature is invalid it won't work. Is it possible that the malware version of Xcode had its signature removed?
  • deleted 11y ago
    [deleted]
  • cheshire137 11y ago
• untog 11y ago
  disabled gatekeeper to get it to run Not necessarily - they might have disabled GateKeeper a long time ago and never re-enabled it. I have the same complain with Android's "allow software from third parties" checkbox - it's a little useless because you uncheck it for one specific app you downloaded, but probably leave it unchecked forever more.
  • cjensen 11y ago
    If you run an app that gatekeeper forbids, when you go into settings to fix that there is a button to approve that single app. There's no need to let everything through.
    • Flimm 11y ago
      Same with Android.
      • cibyr 11y ago
        Is that new in M? I haven't seen that on Lollipop (5.1)
• liquidise 11y ago
  I'm fascinated that there are people on HN who have not disabled GateKeeper. I'm not sure i've used a machine since it was added where i haven't disabled it within an hour of setting up a machine.
  • epmatsw 11y ago
    How often do you install new software that's unsigned? I've only done it a couple of times, and once you override Gatekeeper for a specific app it never asks you for that one again.
    • cheshire137 11y ago
      I rarely find apps on the Mac app store, they're usually always from the app's creator's website. Recent ones I can think of include Bowtie and Sublime Text 3.
      • epmatsw 11y ago
        There's an option for app store + signed apps, which is fairly lenient. Bowtie I think is dead though, so it's possibly still unsigned at this point.
      • stephenr 11y ago
        So? Once you open an app once (right click and open) it's white listed by gatekeeper.
      • mnem 11y ago
        Sublime Text 3 is signed: $ spctl --assess --verbose /Applications/Sublime\ Text.app /Applications/Sublime Text.app: accepted source=Developer ID Or have you downloaded a special version from a Chinese file sharing website? :)
      • msbarnett 11y ago
        Most apps are signed nowadays, regardless of whether or not you're getting them from the store.
• funkysquid 11y ago
  I keep gatekeeper disabled because I don't want app developers to have to sign up with (and I believe pay money to) Apple to setup a Developer ID. (but I also don't download Xcode from random places)
  • jakejake 11y ago
    It's easy enough to run unsigned apps, you just have to ctrl+click and select "open" then you'll get a different prompt that allows you to install the app anyway. I suppose you can argue that, if that's the case, what's the point? Well, if you think that a piece of software should be signed but it is in fact not signed properly, then that's a clue that it's been tampered with. If the software isn't signed at all, then at least I can decide whether I trust the source enough to install it.
• Osmium 11y ago
  > Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? This is generally known as hubris. We think we're smart and that the rules don't apply to us, because we know better than the other people. Turns out they can protect us too. Who knew? In this instance, I'd give the Chinese developers the benefit of the doubt, having recently had first hand experience myself of just how obstructive and irritating the great firewall can be (I was struggling to download small files my entire visit, like a 10MB pdf; I can't imagine trying to download a multi-gigabyte file). So perhaps this was the only way they could get work done–in which case it's on Apple to improve their CDN within China. More broadly, it seems like though there's a careful line to be walked between locking down a computer (e.g. gatekeeper, system integrity protection) and keeping it 'open', I'm personally much more in favour of the former by default provided that the end user can disable it if necessary. It seems like the only realistic option going forward. Perhaps Xcode should be included under the SIP umbrella too?
  • perrycynic 11y ago
    The whole point of Gatekeeper is that you can download your software from anywhere and it'll integrity-check it for you. "The downloads were too slow" has no bearing on "and then I saved three minutes by skipping the security check on the software I got from an untrusted site." :-(
    • Osmium 11y ago
      Absolutely, but one might just suspect that the download was corrupted, no? Especially in these circumstances. I think as developers we have a responsibility not to assume that, and to be diligent, but I can understand how it happened.
  • CountSessine 11y ago
    in which case it's on Apple to improve their CDN within China I'm not quite sure why it's up to anyone outside of China, Apple included, to bear the cost of China's firewall dickery. This is on China to turn off their firewall or bear the costs, commercial and otherwise, of this stupidity. Perhaps Chinese developers shouldn't be allowed to submit apps to the non-Chinese app store?
• msbarnett 11y ago
  Any time one of those "Quickly set up an OS X dev machine!" setup scripts makes the rounds, you can practically guarantee that the script disables Gatekeeper and the file download quarantine because the author "found it annoying/useless/pointless/mai freedums". You end up with one guy intentionally shooting himself in the foot, and 100s of others running his "helpful" script and shooting themselves in the feet without even realizing it. Developers as a group are at least as stupid about security as everyone else.